Implement restrictions on what roles admins can assign.

Roles are still somewhat global, so admins can still create new roles on
demand, but they are prevented from assigning roles that already exist
inside apis outside what they have access to. This prevents admins in
other groups from assigning roles that are in use by another group.

Add some integration tests surrounding the roles selectize inputs.

Upgrade ember-model to the latest from master (currently unreleased)
since it fixes an issue that prevented queries from being re-fetched
(the cache wasn't being cleared).